OpenAI 开源了 Codex Security CLI，这是一个基于 AI 的代码安全扫描工具，支持组织级扫描和 CI 集成。
推荐理由常规快讯，保留列表
原文
This looks great, thanks for open-sourcing it!How does it deal with the current guardrails 5.6 Sol has on finding vulnerabilities? When I use it in the Codex app it would sometimes say it found a vulnerability, but it cannot tell me what it is.
I tried it, it started a scan but stopped after hitting the rate-limit of my account. It gave up after just a minute of retrying (rate limits are tokens per minute, so... :P).It said "Partial output was kept at <...>", but I dont see a obvious way of picking it up in a new scan? (The failed run cost me ~$13)
We are actively working on officially supporting this. Because it's open source it is pretty easy to point a coding agent at it now and switch out the model.
The plugin, including when invoked through the Codex CLI, is great for scanning the repo you're currently working in. The standalone Security CLI/SDK uses the same scanner, but is built for running security across many repos over time: org-wide scans, historical results, deduplication, false-positive tracking, budget controls, and CI integration.We've been talking to hundreds of engineering and security teams, and their feedback is shaping what we build.Like Promptfoo, our goal is practical tooling that fits into the workflows teams already have.
> co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI.> Thanks for checking this out and for flagging the auth issues.Offtopic, but this right here is why I don't believe any marketing around "great amazing models that one-shot everything and programmers are no longer needed".You just have to look at what these labs routinely produce, and their own products.Edit to respond to @simonw whose comment I saw before he retracted it ;)This comment is tied directly to consistent continuous claims by the LLM labs. Their own products disprove their own claims, and it would indeed be nice if fewer people believed them :)
Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: Repository HEAD changed while the scan was running. Start a new scan. codex-security: Partial output was kept at ...
Update: As far as I understand, this was already available as a Codex plugin. The main news is that OpenAI has now open-sourced it, and development is still moving quickly.
security tools from AI companies feel like fire departments run by arsonists. useful, sure, but you can't help noticing who benefits from all the fires
I seem to have gotten a bunch of you are trying to stuff we don't allow errors.. very annoying.Can they explain what types of projects it works on and how does it check I own it? Like will it just not work on Linux kernel even on my own patches to it?
Looks great but the CLI output is not particularly interesting while the scan is running. I wish it could show token usage, some kind of progress, etc.
How does it work? Does the tool upload code to ChatGPT for analysis? That may not be allowed for some corporate projects.
Yes, if only due to the business models being entirely different. AWS sells compute. OpenAI sells models. One of these things benefits from training on your data significantly more than the other.
I wonder if tools like this will put companies like snyk out of business. We use snyk at work and I have not been satisfied.
I don't understand why Snyk is IN business in any way. Who really wants to upload his own code to a company that is specialized at searching security issues?How can I trust that they show me all findings they have instead of selling the best ones to some three letter organisations?
All of codex is a wrapper around their models. There’s still value in a purpose-built harness.
yeah you mean because OAI is only whitebox? or expand on that a bit, haven't played around a ton w the oss codex sec
I was actually discussing solutions for this with my coworkers—building white-hat security agents. It seems like openai/codex-security could simplify a lot of that, or at least provide a version of Codex that's purpose-built for security workflows. Really exciting news!
The scanner is the least interesting part of this. The harness around it is the product: dedup across runs, false-positive tracking, budget controls, CI gating. That is the layer where we'll see most interesting innovations in my opinion.I'm building AQ, a coding harness for teams and the pattern is identical. For a while, I thought the raw model is the answer and quickly changed my mind. Purpose built harnesses are way more powerful than it sounds.
讨论
暂无评论。